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A Security System 

This invention relates to security systems, and in particular to a security system 
\ arranged in use to facilitate passive access to and/or use of a protected object or area 
") such as a vehicle. 

When fitted to a vehicle, a "Passive entry and passive go" security system allows a 
user to : 

Gain entry to the vehicle by operating for example a door handle; and to 
Remobilise the vehicle to facilitate for example starting. 

The user can achieve this merely by having a transponder about their person, i.e. 
without inserting or operating a key. 

A system of this kind might operate by sending a challenge to a transponder using a 
low frequency signal (e.g. 1 25 kHz). The transponder would then reply with an 
encryption of the challenge on a higher frequency (e.g. 434MHz)« The challenge is 
sent on the operation of e.g. the door handle. The low frequency signal may be sent 
from coils located near the front doors and boot. Further coils may be installed in the 
fnterior of the vehicle in an attempt to determine when the transponder is inside the 
vehicle to allow e.g. engine starting. 

It is a problem with some prior art security systems that a criminal can interpose 
transmitter-receiver pairs with a 2- way link between the vehicle and the owner. The 
criminal might succed in gaining access to th$ car, although the authorising 
transponder is not locally present. It is possible that no knowledge of the system 
encryption may be required. Some protection against this is provided by requiring the 
equipment to be sophisticated and any attempted rely hacker to be skilled and 
knowledgeable/observant. One system which offers protection , against a relay hacker 
is disclosed in GB 2332548 and its contents are hereby included in the disclosure of 
this application. 

It is an objetct of this invention to provide an improved security system. 

The invention will now be described with reference to the accompanying drawings. 

In one known system, the transponder requires three orthogonal coils to guarantee 
reception of the signal from the car. In this invention, the signals from the three 
transponder coils are processed so that the transponder is able to determine the vector 
of the incoming signal from each of the three vehicle coils, A, B and C. This 
information is sent back in the encrypted response. The system requires that the 
angular separation between the vectors falls within predetermined limits set by the 
geometry of the vehicle. 

To reproduce the signals, a hacker would have to employ additional apparatus and 
would have to place them in specific locations with respect to the target. The hacker 
would also have to deduce the operation of the system, which is difficult as it uses a 
hardware configuration similar to a standard system but with the operation buried in 
the signal processing and encrypted data. 

The base station (car) 10 sends the challenge or challenges sequentially on two or 
more of the base station coils. The signal from each is identified with it's location, A, 
B, or C. Note that the probable location of the transponder is known to the car 10 as 
the operation is, typically, initiated by the operation of a user operated control means 
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such as for example a door handle 20 or a starter switch 30. The transponder contains 
three substantially orthogonal coils, X, Y & Z, These are connected via analogue 
switches to a single LF receiver (or to three LP receivers without analogue switches.) 
The level of the signal in each coil, X, Y & Z, is measured and the values encrypted 
^ and returned with the response from the transponder. 1 

} Note that the level may be a negative value. This is not absolute and it is assumed that 
' one of the directions, e.g. x, is defined as positive and the others are positive or 
negative depending on the sense of the signal 

It is likely that the message format will be a challenge response with an authentication 
function as well as the levels x, y & z, i.e.: 

Challenge:- Idem. Challenge 

Response:- Encrypted [Idem, challenge x y z] 

Clearly, the encryption must be a symmetrical algorithm and the encryption key(s) 
stored in both the transponder and controller. 

The response from the transponder will generally be an RF signal similar to the 
remote locking communication. The controller receives and decrypts this response. 
The decrypted response is checked to ensure that the challenge matches with the 
transmitted challenge. This authenticates the key in the conventional fashion. 

The decrypted signals x, y & z are related to the direction of reception due to the 
approximate cosine relation between coil orientation and incident vector. 2 
Therefore, the controller ECU on the vehicle can now derive this 3D vector from the 
relative amplitudes x, y and z of the signals in the coils. The angle of the vector from 
transmission A can be expressed as: 

<|>a =* f(x Al yA, za), similarly for B and C 

The angular differences between the vectors for the transmissions from each of the 
vehicle coils A, B, C... are then derived: - 

4>ab ° (|>a - 4>b; 
4>bc - 4>a - <t*c. 



The basestation will only allow entry or remobilisation if the encrypted response is 
correct and the angles meet criteria related to the geography of the vehicle. 
For an application with three vehicle coils, A, B, C located in the exterior mirrors and 
at the rear window; 



! Note that the vector could be pre-calculated in the transponder and the result transmitted back. 
However, it is easier to make this calculation in the vehicle ECU as it is typically faster due to the 
power supply availability. 

" Note thai .mis -direction is defined in a frame of reference containing the transponder. As the 
transponder may be at any orientation, this vector has no defined relationship to the vehicle, 
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For entry from the RHF door, 1 , 

For entry from the LHF door, 2, 

For entry from the boot, 3, 

For remobilisation from the drivers seat, 4, 



270°xf> AC > 90° 
270°><t>cB > 90° 
90°>(|) AB > 30° 
210°><j> AB > 150° 



(Angles defined by geography of vehicle — these are typical" values) 

In practice, more vehicle coils may be used to reduce the range required from each 
coil. 



Relative Phase 

Note that for any given set of signals received in X, Y and Z, there are two possible 
solutions for the vector, diametrically opposite. To resolve this issue, it is necessary to 
retain the phase information when measuring the first direction, <J> A and to solve <|>b 
with the same phase reference. When <|>ab is calculated, the relative phase is known 
and the value for <J>ab can be determined- 



Absolute Location 

Note that for a passive start application, it is required that the transponder, and hence 
the driver, is in the car, not adjacent to it before allowing the car to be started. 
"Conventional" passive systems utilise the limited range of specifically located 
interior LF coils to determine this. This is not reliable, as the range of system 
components will vary, as will the presence of metal objects and other distorting 
factors. Use of the three orthogonal coils X, Y, Z provides substantially absolute 
confirmation of the location of the transponder inside the vehicle. 



Seif Calibration 

Two requirements for the coils X, Y, Z may create problems: 

• Tn the interests of sensitivity, the Q of the receiver coils will be high. This will 
lead to variations in signal response. 
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• To produce a flat "credit card" transponder, one of the coils may need to be a 
low profile type, also leading to a varying sensitivity. 
This may lead to a requirement for a self-calibration function. This is achieved by 
^fr adding a fourth coil equally spaced in angle between the other three and can be used 
to inject a signal into the three receiver coils and allow them to be calibrated. This 
calibration can be either 

Used to pre-process the signals x, y & z before transmission from the transponder or 
Transmitted in the encrypted response and used by the controller to normalise the 
signals. 

Mechanical Implementation 

The coil assembly may be embeded in a plastic or epoxy material with the silicon. 
This is to exclude casual inspection or monitoring of the signals by a hacker. 



Further Enhancements 



Frequencies 

The embodiment described so far relates to a system where the vehicle transmits at a 
nominal 125kHz and the key responds at 434MHz. Clearly, the related 315, 868 and 
900 etc bands can be used. 

It may be desirable to use other frequencies for the communication from the vehicle. 
For example, the use of 13.56MHz would allow a lower power transmission and a 
greater range. The coils X, Y, Z structure could be changed in scale and perhaps, 
structure, to accommodate the change. 

Equally, the use of 434MHz in both directions may allow for some cost reduction in 
the transponder due to the communisation of the frequencies. 

Hall Effect 

Hall effect sensors could be used instead of coils. 

If using a hall effect sensor for direction measurement, then data can also be sent 
without a carrier frequency. 3 



Field Rotation 

It is possible to introduce a further degree of difficulty into a hacker's task by rotating 
the field direction from the vehicle coils. If, for example, two orthogonal coils were 
placed at a given location, the field vector received by the transponder would vary 
depending on which coil is activated. This additional information can be returned to 
the vehicle and used as additional validation of direct communication with the 
transponder. 
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Alternatively, the field direction can be modified in a pre-determined manner on a bit 
by bit basis as a code modulation. The transponder will only respond to a correct code 



} in this modulation- 
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CLAIMS 



2. 



3. 



4 



5. 



A security system comprising a plurality of signal transmitting means 
spaced around a protected area and a transponder arranged in use to receive 
signals from the transmitting means, wherein the transponder is arranged in 
use to determine, from signals transmitted by a plurality of the transmitting 
means, vector information relating to the relative position with respect to tiie 
transponder of the transmitting means. 

A security system according to Claim 1, wherein the vector information 
comprises the vector of the incoming signal from one or more signals from tihe 
transmitting means. 

A security system according to Claim 1 or Claim 2, wherein, for detection 
by the transponder of said signals, the angular separation in the region of the 
transponder between the vectors of the transmitted signals falls within 
substantially predetermined limits- 

A security system according to Claim 3, wherein said limits are set by the 
geometry of the protected area. 

A security system according to any preceding Claim, wherein the 
transmitting means comprise a series of substantially orthogonally spaced 
coils. ; 

A security system according to Claim 5, wherein said series comprises 
three coils. 



7. 



A security system according to any preceding Claim, wherein the 
transponder sends the vector information back to the protected area in a 
response signal- 



4 * 
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A security system according to Claim 7, wherein the response signal 
includes information related to the signal strength from the transmitting 
means. 

9. A security system according to Claim 7 or Claim 8, wherein the protected 
area will allow entry and/or use only if said vector information meets 
predetermined criteria related to the position of the protected area with 
respect to the transponder. 

10. A security system substantially as described herein with reference to he 
accompanying drawings. 
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